[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[upki-fed:00989] Shibboleth IdP 3.2.0におけるStoredIDの定義について
- Subject: [upki-fed:00989] Shibboleth IdP 3.2.0におけるStoredIDの定義について
- Date: Thu, 17 Dec 2015 17:46:13 +0900
- From: Tatsumi Hosokawa <xxxxxxxx@xxxxxxxxxxxxxx>
慶應義塾ITC本部の細川です。
現在、テストフェデレーションで学認のIdPのShibolleth 3化実験を行っているのですが、
IdP 3.2.0を用いたStoredIDのところで躓いています。
とりあえず新しくMySQLサーバを起こして、今までどおり
CREATE TABLE IF NOT EXISTS shibpid (
localEntity TEXT NOT NULL,
peerEntity TEXT NOT NULL,
principalName VARCHAR(255) NOT NULL default '',
localId VARCHAR(255) NOT NULL,
persistentId VARCHAR(36) NOT NULL,
peerProvidedId VARCHAR(255) default NULL,
creationDate timestamp NOT NULL default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP,
deactivationDate timestamp NULL default NULL,
KEY persistentId (persistentId),
KEY persistentId_2 (persistentId, deactivationDate),
KEY localEntity (localEntity(16), peerEntity(16),localId),
KEY localEntity_2 (localEntity(16), peerEntity(16), localId, deactivationDate) )
ENGINE=MyISAM DEFAULT CHARSET=utf8;
でテーブルを作り、attritbute-resolver.xmlで、ComputedIDを無効化し、
<resolver:DataConnector xsi:type="StoredId" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
id="storedID"
generatedAttributeID="storedID"
sourceAttributeID="eduPersonPrincipalName"
salt="ソルトの値">
<resolver:Dependency ref="myLDAP" />
<ApplicationManagedConnection jdbcDriver="com.mysql.jdbc.Driver"
jdbcURL="jdbc:mysql://サーバのIPアドレス:3306/データベース名?autoReconnect=true"
jdbcUserName="storedID"
jdbcPassword="パスワード" />
</resolver:DataConnector>
のエントリを有効化しました(sourceAttributeIDにuidではなくEPPNを使っているのはうちの事情です)。
この状態で、認証が成功した後のWebブラウザには次のエラーメッセージが出力されます。
opensaml::FatalProfileException
The system encountered an error at Thu Dec 17 16:54:46 2015
To report this problem, please contact the site administrator at root@localhost.
Please include the following message in any email:
opensaml::FatalProfileException at (https://test-sp1.gakunin.nii.ac.jp/Shibboleth.sso/SAML2/POST)
SAML response reported an IdP error.
Error from identity provider:
Status: urn:oasis:names:tc:SAML:2.0:status:Responder
Message: An error occurred.
実際にはShibboleth起動時に次の警告とエラーがidp-process.logに出ており、
そもそもStoredIDの処理が初期化できていないようです。
2015-12-17 16:54:20,364 - WARN [net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx:474] - Stored Id Store: The database was not reachable or was not defined with an appropriate table + primary key
java.sql.SQLException: Duplicate insertion succeeded, primary key missing from table
at net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx.verifyDatabase(JDBCPersistentIdStoreEx.java:799)
2015-12-17 16:54:20,373 - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:957] - Closing ApplicationContext:shibboleth.AttributeResolverService: startup date [Thu Dec 17 16:54:19 JST 2015]; parent: Root WebApplicationContext
2015-12-17 16:54:20,440 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: Failed to load [file [/opt/shibboleth-idp/conf/attribute-resolver.xml]]
at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:344)
Caused by: net.shibboleth.utilities.java.support.service.ServiceException: Unable to initialize attribute resolver for ApplicationContext:shibboleth.AttributeResolverService
at net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverServiceStrategy.apply(AttributeResolverServiceStrategy.java:74)
Caused by: net.shibboleth.utilities.java.support.component.ComponentInitializationException: Attribute Resolver 'ShibbolethAttributeResolver': Plugin 'eduPersonTargetedID' has a dependency on plugin 'computedID' which doesn't exist
at net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl.checkPlugInDependencies(AttributeResolverImpl.java:501)
要するに、
java.sql.SQLException: Duplicate insertion succeeded, primary key missing from table
と怒られているので、
https://wiki.shibboleth.net/confluence/display/IDP30/PersistentNameIDGenerationConfiguration
を見て、とりあえず
CREATE TABLE shibpid (
localEntity VARCHAR(255) NOT NULL,
peerEntity VARCHAR(255) NOT NULL,
persistentId VARCHAR(50) NOT NULL,
principalName VARCHAR(50) NOT NULL,
localId VARCHAR(50) NOT NULL,
peerProvidedId VARCHAR(50) NULL,
creationDate TIMESTAMP NOT NULL,
deactivationDate TIMESTAMP NULL,
PRIMARY KEY (localEntity, peerEntity, persistentId)
);
でMySQLのテーブルを作りなおしてみました。すると、idp-process.logは、
2015-12-17 17:14:58,435 - WARN [net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx:782] - Stored Id Store: Duplicate insert failed as required with SQL State '23000', ensure this value is configured as a retryable error
2015-12-17 17:14:58,441 - INFO [net.shibboleth.idp.saml.nameid.impl.JDBCPersistentIdStoreEx:467] - Stored Id Store: Data source successfully verified
2015-12-17 17:14:58,454 - INFO [net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:957] - Closing ApplicationContext:shibboleth.AttributeResolverService: startup date [Thu Dec 17 17:14:57 JST 2015]; parent: Root WebApplicationContext
2015-12-17 17:14:58,537 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] - Service 'shibboleth.AttributeResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: Failed to load [file [/opt/shibboleth-idp/conf/attribute-resolver.xml]]
at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:344)
Caused by: net.shibboleth.utilities.java.support.service.ServiceException: Unable to initialize attribute resolver for ApplicationContext:shibboleth.AttributeResolverService
at net.shibboleth.idp.attribute.resolver.spring.impl.AttributeResolverServiceStrategy.apply(AttributeResolverServiceStrategy.java:74)
Caused by: net.shibboleth.utilities.java.support.component.ComponentInitializationException: Attribute Resolver 'ShibbolethAttributeResolver': Plugin 'eduPersonTargetedID' has a dependency on plugin 'computedID' which doesn't exist
at net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl.checkPlugInDependencies(AttributeResolverImpl.java:
501)
のように変化し、とりあえずMySQLのチェックは、
Stored Id Store: Duplicate insert failed as required with SQL State '23000', ensure this value is configured as a retryable error
Stored Id Store: Data source successfully verified
のように成功していますが、それでも結局attribute-resolver.xmlの読み込みは失敗してしまっているようです。
やはり、storedIDの記述自体を色々書き換える必要があるのでしょうか。
ご存知の方がいらっしゃいましたら、ご教授いただけますでしょうか。
よろしくお願いいたします。
--
慶應義塾ITC本部 細川達己 xxxxxxxx@xxxxxxxxxxxxxx
Tel. 03-5427-1685 Fax. 03-5427-1722